What follows are some examples of how to use IAM. The setup from the first example is required to be able to complete the rest of the examples.

What follows are some examples of how to use IAM. The setup from the first example is required to be able to complete the rest of the examples.

−

−

{{admon/important|This tutorial requires euca2ools 2|Most of commands in this tutorial require version 2 or later of the euca2ools command line suite. A pre-release of version 2.0 is available from http://repos.fedorapeople.org/repos/gholms/cloud/.}}

=== Get Your Account Details ===

=== Get Your Account Details ===

Latest revision as of 18:29, 10 September 2013

Amazon Identity and Access Management (IAM) is a web service that allows one to manage users and groups, and assign permissions to them as needed to improve the security of one's Amazon Web Services (AWS) account. By using IAM you can easily consolidate billing, make key rotation easier, and limit the damage that a compromised set of credentials can cause. The objective of this primer is to familiarize the reader with IAM's functionality and terminology. For more detailed documentation, see the AWS website. For help with Fedora on EC2, ask the Fedora Cloud SIG.

When you sign up for AWS you create an account, an entity that centrally controls all the resources that you create and pays for all of its activity. An account is similar to the superuser on a regular computer in that it always has permission to use all of AWS's functionality. It also has a password that allows you to access the AWS website and view billing information.

A user is an entity that represents a person, a computer, or a program that can interact with AWS in the same manner as an account. Unlike an account, however, you can restrict a user to a subset of all of AWS's functionality.

Both accounts and users use security credentials to interact with AWS programmatically. Tools use security credentials to cryptographically sign the messages they send to AWS so they can prove who they represent. Whether a set of credentials belongs to a user or an account, the ways in which they are used are identical.

A resource is an object in an AWS service that you can interact with, such as a bucket or object in Amazon S3. Resources typically have both human-readable names (e.g. mybucket) and unique, machine-readable names.

A policy states that a user or group is allowed to access a set of resources or run a set of commands in AWS. For instance, a policy may state that the S3 bucket called mybucket should be readable by the users alice and bob. Alternatively, a permission may state that the user alice has permission to run instances in Amazon EC2.

Policies can deny access instead of allowing access. A policy that explicitly denies access always takes precedence over a policy that allows access.

Using account credentials for everything is akin to logging into a computer as the root user for daily work. While it may be easier, doing so opens you up to unnecessary risks in the event of a mistake or a breach of security.

Some examples of when IAM is useful include:

Limiting the effects of errors in automated scripts

Providing limited, short-term accounts for a Fedora test day inside of EC2

One can interact with IAM through either a web-based management console or via euca2ools, a suite of command line tools designed for services like IAM. This tutorial will focus on using IAM with euca2ools at the command line. This tutorial also assumes that you already have an active AWS account.

To use the command line tools you first need to obtain access keys for your account. You can find them by going to the AWS management console on the web, clicking your name on the top, followed by
Security Credentials, and scrolling down to the section titled Access Credentials. Make note of the Access Key ID and the Secret Access Key that appears beside it. Both of them should be long sets of alphanumeric characters. Create a file called .iamrc in your home directory that contains those keys in this format:

AWSAccessKeyId=your_access_key_id
AWSSecretKey=your_secret_key

Since euca2ools is designed to work with all AWS-compatible clouds, not just AWS itself, it needs to know which cloud to contact. Create a file called .eucarc in your home directory with the following content to point it toward AWS:

Amazon recommends using account credentials as little as possible. You can avoid using account credentials by creating a group of users with administrative privileges. First create a group called administrators:

$ euare-groupcreate -g administrators

If you wish, you can show a list of your groups to check that the command worked:

While IAM policies are typically written in a machine-readable format called JSON, this policy is simple enough that it is unnecessary. Regardless of their complexity, IAM policies are always broken into sections in the manner shown above.

This command displays two lines of text. The first is the user's access key ID, while the second is the user's secret key. Open ~/.iamrc with your favorite editor, replace the account credentials you added earlier with the user's credentials you just created, and then switch euca2ools over to using those.

$ ed ~/.iamrc
$ source ~/.eucarc

Active keys are limitedAWS limits each user to two access keys at a time. euare-userlistkeys can list a user's keys, while euare-userdelkey can delete them.

In this example we will create a limited user for an automated script that creates snapshots of volumes in EC2. This will give the script permission to perform its function, while preventing it (or anyone who gets their hands on the script's credentials) from doing anything else.

Amazon recommends applying permissions to groups, not users, so create a ebs-backup group for this purpose:

$ euare-groupcreate -g ebs-backup

Next, this group needs a policy that allows its members to create snapshots. The easiest way to create non-trivial policies is with Amazon's Policy Generator, where you can create a policy for the Amazon EC2 service that allows the CreateSnapshot action by choosing the appropriate options. You end up with a policy that looks like this:

When a user is no longer needed you can delete it with euare-userdel. Before a user can be deleted it must first be removed from all groups and have no policies, keys, certificates, or login profiles. If this sounds annoying, that is because it is. So if you wish, euare-userdel will delete them all for you if you pass it -r:

A login profile is a password that allows a user to log into AWS's web-based console. A user can have up to one login profile at a time. You can manage login profiles with euare-useraddloginprofile, euare-usergetloginprofile, and euare-userdelloginprofile.

A user with a login profile can log into AWS's web console at https://your_AWS_Account_ID.signin.aws.amazon.com/console/. Since account IDs are numeric and can be difficult to remember, you can also create an account alias to use instead: